Skill UI

This skill provides comprehensive guidance and PowerShell scripts for hardening Windows endpoints using Microsoft Defender for Endpoint (MDE). It covers advanced features like Attack Surface Reduction (ASR) rules to block common attack techniques, Controlled Folder Access for ransomware protection, and Network Protection. Use this for deploying enterprise-grade, compliance-required security policies via Intune or Group Policy.

This skill monitors critical OT historian servers (such as OSIsoft PI and Ignition) located at the IT/OT boundary. It is designed to detect sophisticated cyber threats, including unauthorized access attempts, data manipulation, suspicious query patterns, and indicators of lateral movement between enterprise and control networks. Use it to validate data integrity and respond to potential ICS security incidents.

This skill provides methods and tools for detecting sophisticated cyber attacks targeting Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS). It focuses on detecting anomalies like unauthorized command injection, Man-in-the-Middle attacks on industrial protocols (Modbus, DNP3), and data manipulation, which traditional IT security tools often miss. Usage involves establishing deterministic communication baselines and monitoring network traffic for deviations.

This skill analyzes AWS CloudTrail logs to detect suspicious API call patterns, such as new event sources, geographic anomalies, or high-frequency usage. It establishes a statistical baseline of normal activity and flags deviations indicative of compromised credentials, privilege escalation, or insider threats, providing a detailed JSON report for security investigation and threat hunting.

A comprehensive solution for identifying and preventing the accidental commitment of exposed AWS credentials, API keys, and session tokens within source code, configuration files, and git history. It integrates TruffleHog and git-secrets into CI/CD pipelines and pre-commit hooks, providing critical protection against credential theft and unauthorized cloud access in a DevSecOps environment. Essential for security auditing and compliance.

This skill analyzes AWS IAM policies using boto3 and Cloudsplaining principles to detect potential privilege escalation paths in AWS accounts. It identifies overly permissive policies, dangerous permission combinations (such as combining role passing and resource creation), and violations of least-privilege principles. It is designed for security incident investigation, threat hunting, and validating overall cloud security posture.

This guide teaches security teams how to deploy and operationalize Amazon GuardDuty for continuous, comprehensive threat detection across entire AWS accounts and workloads. It covers enabling protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, interpreting various finding severity levels, and building robust, automated incident response playbooks using EventBridge and AWS Lambda for immediate containment actions.

This skill guides security testers in identifying excessive data exposure in REST and GraphQL APIs. It involves intercepting API responses and analyzing them for leaked Personally Identifiable Information (PII), internal identifiers, or sensitive business data that the client UI does not display but the API transmits. It maps directly to OWASP API3:2023 Broken Object Property Level Authorization, helping prevent data leaks via over-fetching.

A comprehensive skill for detecting and exploiting JavaScript prototype pollution vulnerabilities in both client-side and server-side applications. It demonstrates advanced property injection techniques to achieve critical security outcomes, including Cross-Site Scripting (XSS), Remote Code Execution (RCE), and authentication/authorization bypass, especially in Node.js environments and JSON merging scenarios.

This comprehensive guide outlines techniques for authorized penetration testing of real-time web applications using WebSocket connections. It covers discovering various WebSocket endpoints, testing for authentication bypass, identifying Cross-Site WebSocket Hijacking (CSWSH) vulnerabilities, and assessing message handling for injection flaws (SQLi, XSS). Essential for securing chat, trading, and live notification platforms.

This skill details the exploitation of the critical Zerologon vulnerability (CVE-2020-1472) found in the Microsoft Netlogon Remote Protocol. It allows an unauthenticated attacker to compromise a domain controller by resetting its machine account password. The guide covers the complete attack chain, including initial exploitation, credential dumping via DCSync, and subsequent privilege escalation in Active Directory environments. Used exclusively for authorized red teaming and security testing.

This script is designed for malware analysis, specifically targeting .NET-based Remote Access Trojans (RATs) like Agent Tesla. It automatically extracts embedded and obfuscated configuration data, including SMTP credentials, FTP endpoints, Telegram tokens, and C2 webhooks. It utilizes advanced techniques such as regex pattern matching, Base64 decoding, and simulating XOR/SHA256 decryption to reveal critical threat intelligence for security research.